Start free

Legal

Privacy Policy

Last updated:

1. Who we are

MagickVoice (operated by MAGICKVOICE LLP, GSTIN/PAN 36ACHFM1035C1ZP, registered in India) provides an AI-powered voice and multi-channel communications platform that lets businesses build voice agents, run IVR flows, and send WhatsApp, SMS, and email at scale through partner telephony providers (Twilio, Plivo, Exotel, Vobiz, and others).

This policy explains what data we collect, how we use and share it, how long we keep it, and the rights you have over it. By using MagickVoice you agree to this policy and to our acceptable-use rules in Section 7 .

2. Data we collect

Account & identity data

  • Name, email address, phone number, password hash (via Firebase Auth).
  • Tenant / organization name, billing address, GSTIN/PAN where applicable.
  • Role and permission assignments inside your tenant.

KYC & compliance data (for telephony number assignment)

Indian telecom regulators (DoT/TRAI) and our telephony partners require Know Your Customer (KYC) verification before any DID, A2P sender ID, or outbound trunk can be activated for your tenant. We collect and process:

  • Business registration certificate or incorporation document.
  • PAN and GST certificate of the entity.
  • Authorised signatory's PAN/Aadhaar number, photo, and proof of address.
  • Use-case description, intended audience, and expected call/message volumes.
  • DLT (Distributed Ledger Technology) registration entity ID and template IDs for SMS.
  • Sample scripts, prompts, and consent-capture flows used in outbound campaigns.

We only collect what is required by the operator and regulator for the channel you are activating. KYC documents are stored encrypted at rest and access is restricted to compliance personnel and the specific telephony partner processing the activation.

Communications content

  • Phone numbers of contacts you upload (in CSVs or via API).
  • Call recordings and transcripts, where you have enabled recording.
  • WhatsApp, Telegram, SMS, and email message bodies and delivery receipts.
  • Caller / callee phone numbers, call duration, and call result.
  • AI prompt configurations and workflow definitions you create.

Usage & technical data

  • IP address, user agent, OS and browser type.
  • Page views, button clicks, and product events (used to improve the product).
  • API request logs (status, latency, traceparent IDs for distributed tracing).
  • Billing events — credit balance, allocations, settlements per minute / message.

Information from contact / lead forms on this website

  • Your name, email, phone, subject, and free-form message when you fill out our Contact or Lead-Capture forms. We retain this in our customer database and email a copy to our team via Mailjet.

3. How we use your data

  • To provide, secure, and bill the MagickVoice service.
  • To activate phone numbers, sender IDs, and templates with operators.
  • To route calls and messages through the telephony partner of your choice.
  • To run AI inference (speech-to-text, intent, text-to-speech) on call audio.
  • To detect fraud, abuse, spam, and DND violations on our network.
  • To respond to support requests and product feedback.
  • To send transactional notifications (job completion, settlement receipts) and, if you opt in, occasional product updates.
  • To improve the product. Aggregated / de-identified usage data may be used for analytics and model evaluation. We do not train foundation models on your call recordings or prompts.

4. Legal basis

We process personal data on the following legal bases:

  • Contract — to provide the service you signed up for.
  • Legal obligation — KYC, anti-fraud, tax, and telecom-compliance record-keeping under Indian law (including the DPDP Act 2023, TRAI regulations, and the IT Act 2000).
  • Legitimate interest — securing the platform, measuring product usage, preventing abuse.
  • Consent — optional marketing emails, voluntary product analytics. You can withdraw at any time.

5. Service providers & third parties

To deliver the service, we rely on a small set of vetted third-party providers across the following categories. Each provider is contractually bound to confidentiality and data-protection terms, and we share only the minimum data required for their function.

  • Telephony & messaging carriers — to place calls and deliver SMS, WhatsApp, and other messages on your behalf, and to process number activation / KYC submissions.
  • Cloud infrastructure — compute, storage, queues, and scheduling, primarily hosted in the Asia Pacific (Mumbai) region.
  • Authentication — identity verification and session management for sign-in.
  • AI / language-model providers — for speech-to-text, intent and entity extraction, and text-to-speech. Training opt-in is disabled on every provider where the option exists.
  • Transactional email — to send notifications, receipts, and replies to contact-form submissions.
  • Observability — request metrics, distributed tracing, and error reporting. Message content is excluded from these streams.

We do not sell personal data and we do not share it with advertisers. A current list of named sub-processors is available on request for enterprise customers under NDA — write to contact@magickvoice.com .

6. KYC, number assignment & verification

Every phone number assigned to your tenant goes through a verification flow before it can place a call or send a message:

  1. Tenant KYC — your entity's documents are reviewed by our compliance team and submitted to the telephony partner.
  2. Use-case attestation — you describe the intended use (lead-gen, support, OTP, collections, etc.). High-risk verticals (collections, financial cold-outbound) require additional review.
  3. DLT registration (SMS) — sender ID and every template must be pre-registered with the operator's DLT platform.
  4. Concurrency & throttling — each number is provisioned with explicit max-concurrent-calls and per-minute caps to prevent runaway dispatch.
  5. Periodic re-verification — we may request updated KYC at the operator's request or if your usage profile changes materially.

Numbers may be retired or removed from your tenant if KYC lapses, if regulatory complaints (UCC / DND) are filed, or if the operator revokes activation.

7. Responsible-use policy (Acceptable Use)

MagickVoice is built for legitimate business communications. The following are strictly prohibited and may result in immediate account suspension, forfeiture of credit balance, and reporting to operators and law-enforcement where appropriate.

Hard prohibitions

  • Unsolicited promotional calls or messages to numbers registered on DND / NCPR.
  • Impersonation of banks, government bodies, courts, police, or other authorities.
  • Phishing, smishing, OTP-fraud, or any attempt to extract credentials.
  • Threats, harassment, hate speech, sexual content, or content harmful to minors.
  • Operating debt-collection scripts that violate RBI's Fair Practices Code.
  • Spoofing caller-ID to a number you do not own and have not been authorised to use.
  • Robocalling without prior consent, where consent is required by law.
  • Using the AI agent to record people without disclosure where disclosure is legally required (most Indian states require informing the other party that the call may be recorded).

Mandatory behaviours

  • Place outbound promotional calls and messages only within permitted time windows (typically 09:00–21:00 IST for promotional traffic in India).
  • Keep an auditable record of consent for every contact uploaded to your account.
  • Honour opt-out / STOP requests within 24 hours.
  • Disclose at the start of each AI call that the caller is an automated agent.
  • Provide a clear way for the called party to reach a human if they request it.

Platform-level controls we enforce

  • Per-number concurrency caps and per-tenant rate limits.
  • Phone-number normalisation and DND-list checks before dispatch.
  • Anomaly detection on call volume and failure rates.
  • Automatic suspension on operator complaints or abuse signals.

8. Data retention

  • Account & tenant data — for the lifetime of your tenant; deleted within 90 days of account closure unless retention is required by law.
  • Call recordings & transcripts — by default 30 days. Configurable per tenant up to 365 days. Recordings older than the retention window are permanently deleted.
  • Message logs — 12 months for delivery metadata; message bodies follow your retention setting.
  • KYC documents — retained for at least 5 years after account closure to satisfy regulator audit requirements, then deleted.
  • Billing & tax records — 8 years per Indian tax law.
  • Audit logs — partitioned monthly, retained for 13 months.
  • Contact-form submissions — 24 months.

9. Security

  • TLS 1.2+ in transit; AES-256 at rest for sensitive fields.
  • Core telephony API keys stored AES-256-GCM encrypted, decrypted on demand.
  • Role-based access control (RBAC) with least-privilege defaults inside each tenant.
  • Hashed, salted passwords managed by Firebase Auth.
  • Audit log of every privileged action (partitioned by month).
  • Regular dependency scans and quarterly penetration testing.

No system is perfectly secure. If you discover a vulnerability, please report it to security@magickvoice.com .

10. Your rights

Subject to applicable law (including India's DPDP Act 2023), you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or out-of-date data.
  • Erase your data, subject to legal retention requirements.
  • Withdraw consent for optional processing (e.g. marketing email).
  • Export your data in a machine-readable format.
  • Lodge a complaint with the Data Protection Board of India.

To exercise any of these rights, write to contact@magickvoice.com . We will respond within 30 days.

11. Cookies & tracking

This website uses only first-party cookies strictly necessary for login state and CSRF protection. We do not use third-party advertising cookies. Aggregated product analytics (e.g. page-view counts) are collected without persistent user identifiers.

12. International transfers

Primary data residency is in Asia Pacific (Mumbai). Where data is processed outside India (for example, by an LLM provider hosted in the US or Europe), we rely on standard contractual clauses and our sub-processor's data-protection commitments.

13. Children

MagickVoice is not intended for use by individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the product and applicable law evolve. Material changes will be announced in-product and by email to tenant owners at least 14 days before they take effect. Continued use of the service after the effective date constitutes acceptance.

15. Contact

Questions about this policy or about your data?